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ABSTRACT 

This  paper  presents  a  method  for  functional  testing  of  microprocessors. 
First,  we  develop  a  control  fault  model  at  the  RTL  (Register  Transfer  Language) 
level.  Based  on  this  model,  we  establish  testing  requirements  for  control 
faults.  We  present  three  test  procedures  to  verify  the  write  and  read  sequences 
and  use  the  write  and  read  sequences  to  test  other  instructions  in  a  micro¬ 
processor.  By  utilizing  k-out-of-m  codes,  we  can  use  fewer  tests  to  cover 
more  faults,  thereby  reducing  the  test  generation  time. 
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I.  INTRODUCTION 


The  development  of  intecrated  circuit  technology  has  resulted  in  a  vide 

ranee  of  applications  for  microprocessors.  Testing  cf  microprocessors  is  a 

difficult  problem  because  of  the  complexities  of  microprocessors.  The  problem 

is  more  serious  fer  users  due  to  lack  of  infomation  on  internal  implementation 

of  microprocessor*,  and  other  VLSI  chips.  Over  the  past  few  years,  several 

methods  have  been  proposed  to  solve  this  problem.  These  testing,  techniques 

are  essentially  based  on  functional  level  [1-11], 

A  microprocessor  is  a  type  of  complex  sequential  machine.  The  current 

approach  is  to  test  microprocessors  by  instruction  execution.  Generally, 

before  executing  an  instructian-under-test  V7e  have  to  vrite  certain  data 

into  some  registers,  and  after  executing  the  instruction,  read  the  contents 

of  the  registers.  Therefore,  if  the  write  or  the  read  instruction  is  faulty, 

we  may  not  be  able  to  test  the  iustructlon-under-test.  To  solve  this  problem, 

Thatte  and  Abraham  [3]  have  to  label  instructions  and  define  test  order  in 

detail  before  testing.  However,  they  do  not  consider  the  partial  execution 

of  an  instruction.  So  for  instruction  decoding  fault  I. /I.  +1,,  it  is  assumed 

J  j  k 

that  instead  of  executing  I.,  both  instructions  I.  and  I,  are  executed  to 

J  j  k 

completion.  It  is  more  general  and  practical  to  considci  partial  execution  of 
an  instruction  under  fault.  Our  fault  model  allows  this. 

Abraham  and  Parker  [6]  proposed  a  simplified  fault  model.  First,  one 
tests  all  internal  registers,  then  executes  all  instruction  and  data  manipulation 


functions. 


In  this  paper,  we  consider  the  basic  instructions  for  the  write  and  read 
register  functions  as  the  kernel  of  a  microprocessor.  This  kernel  can  be  represented 
by  a  sequential  machine.  Based  on  the  fault  model,  ve  use  checking  experiment 


to  verify  the  kernel.  Then  ve  use  the  kernel  for  testing  other  instructions. 
The  control  fault  node!  is  established  at  the  Register  Transfer  Language  (RTL) 
level,  since  it  is  convenient  to  represent  the  instruction  decoding  faults  and 
other  control  faults  at  such  a  level. 

Section  II  presents  a  fault  model  for  microprocessors,  emphasizing  the 
control  fault  model  defined  at  the  RTL  level  instead  of  the  instruction  level. 
In  Section  III,  after  examining  roost  existing  off-the-shelf  microprocessors, 
we  derive  testing  requirements  based  on  different  types  of  operations.  In 
Section  IV,  we  define  the  write  and  read  sequences  as  the  kernel  of  a  micro¬ 
processor.  Then  Section  V  presents  the  verification  of  the  write  and  read 
sequences.  Section  VI  discusses  the  testing  of  control  faults.  Finally, 
conclusions  are  given  in  Section  VII. 


II.  FAULT  MODEL 


The  functions  of  s  microprocessor  are  mainly  performed  by  instruction 
execution.  The  sequence  of  operations  for  an  instruction  can  be  described 
by  RTL.  We  consider  that  an  instruction  consists  of  a  series  of  RTL 
statements.  The  typical  statement  is  defined  as 

(conditions):  D<-f  (S^,  S2>  ...»  S^,  ...) 

where 

D  -  destination 
-  Source 

f (Sj,  S2,  ...,  S  ,  ...)  -  operation 

Destinations  and  sources  my  be  internal  registers  of  a  microprocessor 
or  external  to  the  microprocessor  (i.e.,  data  bus,  address  bus,  etc.).  We  are 
only  concerned  with  those  internal  registers  which  are  cf  interest  to  users,  so 
we  do  not  consider  implied  registers  such  as  buffers.  For  example,  data  transfer 
from  memory  to  memory'  can  be  described  as  DB^DB^,  instead  of  Buffer'-DE^  followed 


of  memory,  i,j  denote  different  bus  cycles,  DB^  (read  from  memory)  is  ahead  of 
DBj  (write  into  memory) . 

After  examining  most  existing  off-the-shelf  microprocessors,  e.g.  Intel  POt'O 
and  8086,  Zllog  80  and  8000,  Motorola  6800  and  68000,  the  RTL-like  operations 
can  be  divided  into  two  classes,  transfer  operations  (class  T,  D«-S)»  and 
arithmetic  and  logical  operations  (class  A).  Class  A  can  be  subdivided  into 
six  subclasses  based  on  the  combination  of  destinctions  and  sources  as  shown  in 
Table  1,  where  the  content  of  flag  bits  constitute  a  status  register. 


Class 


Type  of  Expression 


Operation 


D<-f(D,s  ,s  ) 


IKf(S1,S2,S  ) 


D1,D^f(D1,S) 


Flags«-f  (S) 


Flags«-f  (S. ,  S„) 


Flags«-f  (S^,  S  2  >  •  < 


EIT  SET 
BIT  RESET 

bit  cokpldient 

INCREMENT 

DECmniNT 

DECIMAL  ADJUST 

SHIFT 

ROTATE 

COITLEHEKT 

NEGATE 

CLEAR 


ADDITION 

ADDITION  \LTH  CARRY 
SUBTRACTION 

SUBTRACTION  VLTH  BORRCN 


EXTE!D  SIGN 


ADDITION,  D«M>j+S,, 


ADDITION,  D<-D+S  +S,, 

1  4. 


ADDITION,  D--S1+S2+S3 


MULTIPLY 

DIVIDE 


BIT  TEST 


COMPARE 


Modifying  flags  for  all 
arithmetic  and  logical  instructions 
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Note  that  the  control  operations  in  RTL  control  statements  such  as 
conditional  branch  are  not  listed  because  ve  can  use  RTL  assignment  statements 
with  conditions  and  expand  the  RLT  description  for  instructions  with  loops. 

A  microprocessor  usually  can  be  divided  into  two  sections:  the  data 
processing  part  and  the  control  part  [2,11] .  In  this  paper,  we  consider  faults 
in  both  parts  with  the  emphasis  cn  the  control  faults. 

A.  Rata  processing  faults 

(1)  Data  storage  fault  (R)/(R)’ 

This  means  that  the  content  of  register  is  changed  from  (R)  to  (R)  '  due 
to  faults  such  as  stuck-at  and  pattern  sensitive  faults. 

(2)  Data  transfer  fault 

The  fault  occurs  in  the  transfer  path  between  the  sources  and  the 
destination.  This  type  of  fault  includes  stuck-at,  bridging  and  pattern  sensitive 
faults. 

(3)  Data  manipulation  fault  (f)/(f)T 

This  is  the  operation  execution  fault.  Under  this  fault,  the  operation 
f  is  executed,  but  the  result  of  operation  is  wrong. 

B.  Control  faults 

This  kind  of  fault  involves  register  decoding  faults,  instruction  decoding 

faults  and  other  control  faults.  A  register  decoding  fault  means  missing  or 

changing  the  selected  register,  or  selection  of  an  extra  register,  denoted  by 

R/$ ,  R/R',  and  R/R-^-R*  respectively.  For  instruction  decoding  faults,  we 

consider  that  an  instruction  can  be  executed  partially.  It  means  missing  or 

changing  the  selected  operation,  or  selection  of  an  extra  operation  in  RTL. 

In  this  case,  the  instruction  decoding  fault  may  be  I./C,  I./Al. ,  1,/AI  , 

J  J  J  J 

I./l,  ,  I./AI.+AI.  ,  I./I.+AI.  ,  I./l.+I,  ,  end  so  forth,  where  Al  means  part  of 
j  k  j  j  k  .1  j  k  j  J  V 


instruction  I 


In  fact,  for  cost  existing  off-the-shelf  microprocessors,  the  register  decoding 


faults  can  be  considered  as  instruction  decoding  faults,  i.e.  TjOcl^/tf', 


R/R'el  /I,  ,  R/R+R’r.I . /I  .+1,  ,  where  I.,  1.  are  transfer  instructions  among 

J  K  2  J  *  J  *• 


registers.  For  example,  let  I.  be  R. ♦memory,  I  be  R^-cenory,  then  fault 

J  J  '  k  k 

Rj/F>^  cfault  I^/ly.  In  addition,  the  control  faults  also  include  instruction 
execution  sequence  faults,  condition  faults  and  so  on. 

From  the  above  observation,  we  assert  that  it  is  appropriate  to  represent 
the  control  faults  at  the  P.TL  level.  Therefore,  we  will  define  the  above 


control  faults  at  such  a  level.  Let  f  denote  IX-f  (S^S^ . . . ) ,  which  is  an  operation 


on  the  instruction-under-test,  and  fe{f},  where  {f}  is  the  set  of  RTL  operations 
of  a  microprocessor.  Let  f*  denote  D’<-f * (Sj,S’». ..),  which  is  an  unexpected 
(faulty)  operations  and  £*e{f}. 

V.'e  new  define  three  classes  (i.e.  nine  subclasses  FI,  F2,  ...»  T9)  of 
control  faults  as  follows: 

(1)  fit,-  No  operation  is  executed. 


FI.  fj± 

(2)  f/f*  -  Instead  of  performing  the  operation  f,  another  operation  f’  is 
executed.  It  contains  two  subclasses  of  faults. 

F2.  6 f / f * :  Here  i  means  that  the  destination  registers  I)  and  D’  are 
different  and  the  fault  is  f/f'. 

F3.  Of :  o  denotes  that  registers  D  and  D'  are  the  same. 

(3)  f/f+f  -  In  addition  to  operation  f,  another  operation  f*  is  also 
executed.  It  can  be  subdivided  as  follows. 

(3a)  Register  D  and  D’  are  different. 

F4.  6f/fH  f 1 :  The  source  register  list  of  f  and  f*  does  not  include 
D*  and  D  respectively.  We  are  not  concerned  with  the  execution  order 
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of  f  and  f ' . 

F5.  till ’f :  The  source  register  list  of  f  includes  I)'.  f’  is  executed 
before  performing  operation  f;  i.e.  the  execution  order  is 

1.  D*«f  (S’,  S’,...) 

2.  D«-f  (S1,S2,...,D’*) 

where  register  without  *  denotes  its  content  before  executing  the  operation, 
register  with  *  denotes  its  content  after  executing  the  operation. 


F6.  6f/ff'  :  The  source  register  list  of  f’  includes  D  and  the  execution 


order  is 


1.  IKf  (S1,S2,...) 


2.  (Sj_,Sj,...,D*) 

(3b)  Registers  D  and  D’  are  the  same,  i.e.  D,E;D.  VJhen  the  source  register 
list  cf  f  and  f'  doas  not  include  D'  and  I)  respectively,  if  the  execution  order 
is  f'f,  the  fault  dees  not  effect  the  execution  of  f.  If  the.  execution  order  is 
f  f',  it  is  the  same  as  the  case  with  the  fault  qf/f*. 


F7.  qf/f ’f :  The  source  register  list  of  f  includes  D,  and  the  execution 


order  is 


1.  D+f’  (SJ.SJ,...) 


2.  EKf  (S1,S2,...,D*) 

F8.  qf/ff * :  The  source  register  list  of  f’  includes  D  and  the  execution 

order  is 

1.  IKf  (S^,Sn,.«.) 

2.  IX-f’  (S’,SJ,...,D*) 

F9.  <rf/f£f  * :  Both  f  and  f’  are  executed  at  the  same  time. 

D*-f  (S^,S2>.«.) 

IXf’  (S|,SJ,...) 

where  L  denotes  logical  AND  or  OP  function.  In  this  case,  the  final  content  of 
the  destination  D  is  the  result  of  the  composite  value  (i.e.  the  result  of  the 


AND  or  OR  function)  of  f  and  f'. 

Note  that  the  above  control  faults  can  occur  at  any  place  in  an  instruction 
execution  sequence.  This  control  fault  model  can  cover  register  decoding,  faults, 
instruction  decoding  faults  (including  partially  instruction  execution), 
instruction  execution  sequence  faults,  etc.,  since  any  control  fault  can  always 
be  defined  as  missing,  changing,  or  extra  RTL  opeations  and  will  cause  registers 


to  have  wrong  contents. 
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III;  REQUIPEir.N’IS  FOR  TESTING  CONTROL  FAULTS 

Our  purpose  is  tc  test  the  execution  of  microprocessor  instructions. 
Therefore,  the  objective  of  test  pattern  generation  is.  tc  find  the  initial 
data  in  registers  (test  data)  needed  for  testing  functions  of  an  instruction 
and  also  the  sequence  of  instructions.  This  test  data  must  satisfy  certain 
requirements.  From  the  control  fault  model  given  in  Section  Tl,  ve  can  obtain 
various  requirements  for  testing  control  faults. 

Let  us  establish  the  following  notation.  For  a  fault-free  operation  f, 
we  have 

V  c  the  value  cf  register  i. 

VS_^  =  the  value  of  the  operand  in  source  register  S^. 

VD  =  the  value  of  the  operand  in  destination  register  D. 

VD*  =  the  value  of  destination  register  D  storing  the  result  of 
operation  f. 

For  a  faulty  operation  f*,  we  obtain  VS^,  VD*  and  VD’*  instead. 

Theorem  1.  Control  faults  T/<J»,  T/T1  and  T/l+T'  can  be  detected  if  the  data 
values  of  registers  satisfy  the  following  requirements: 

QTT1.  VjL  t  Vj  ,  i  h'  3 

QTT2.  V.  I  V  J  V.,  i  /  j 
i  3  i 

Proof.  We  shall  prove  this  theorem  by  considering  the  nine  fault  classes 
defined  in  Section  II. 

(i)  For  fault  FI  (T/<{>)  and  F2  (6t/T’),  in  order  to  verify  transfer 
operation  T,  one  needs  VS  4  VD. 

(ii)  For  fault  F3  (oT/T1),  the  results  of  T  and  T'  should  be  different, 
i.e.  VD*  i  VD'*.  To  obtain  this  result,  we  must  have  VS  4  VS  * . 

(iii)  For  fault  F4  (6T/T+T’)  and  F3  (6t/T'T),  ve  need  only  to  detect  the 
extra  operation  T*.  Therefore,  VS  *  4  VD r . 


(iv)  rault  F6  (fiT/TT*)  means  that  transfer  ore-ration  D<  S  is  performed 
first,  then  P'-'-D*.  In  order  to  detect  the  extra  operation.  T’,  one  needs 

vs  4  vp'. 

(v)  Fault  F7  (gT/T’T)  yields  P'-S'  fol3ovod  by  Therefore,  ve  obtain 

the  requirement  VS1  1  TO. 

(vi)  For  fault  F8  (oT/TT'),  ve  have  P'S,  then  IKP-'.  This  fault  does  net 
affect  operation  T.  In  order  to  verify  T»  ve  need  VS  £  VP. 

The  above  six  requirements  belong  to  QTT1. 

(vii)  For  fault  F9  (^T/TIT1),  the  composite  value  of  both  results  of  T  and 
T*  should  be  different  from  the  correct  result  of  T.  i.e.  VSLV S’  r  VS  v'nich 
belongs  to  QTT2. 

O.E.P. 


Theorem  2.  Control  faults  T/A'  end  T/T+A*  can  be  detected  if  the  data  values 
of  registers  satisfy  the  following  requirements: 


QTA1. 

Vvj  , 

QTA2. 

f  J  f  vs 

QTA3. 

f'  ^  VP' 

A 

QTA4. 

VZLfJ  +  VS 

vhere  f'  is  the  result  of  operation  of  class  A,  i.e.  f!  c  f’  (VS',  VS',...). 

A  A  A  l  i~ 

?roof .  The  proof  is  similar  to  the  proof  for  Theorem  1.  Since  A’  instead 
of  T*  is  performed,  v:e  can  change  VS'  to  f'  in  the  requirements,  (ii),  (iii), 

A 

(v)  and  (vii)  in  the  Proof  for  Theorem  1  to  obtain  the  corresponding 


requirements  for  Theorem  2. 


(i)  For  F2  (6T/A'),  VS  t  TO,  (QTA1) . 

(ii)  For  F3  (OT/A'),  VS  4  f^,  (QTA2) . 

(iii)  Fcr  F4  (6T/1+A')  and  F5  (STM’!),  f’  ^  VP’,  (QTA3) . 

A _ 

(iv)  For  P6  (6T/TA'),  it  means  that  Ib-S  first,  then  P'-*-f'  (S',S',...,P*). 


We  need  f^  (VS^.VS^  . VS)  4  VD'.  Since  VS  can  be  selected  as  any  initial 

data  value,  it  can  bt  considered  as  one  of  several  source  operands.  Therefore, 
vt  can  rewrite  (VS',  VS^  ,...,VS)  4  VD'  as  f^/  VD',  (QTA3) . 

(v)  For  T7  (cT/A'T),  V  4  TO',  (QTA3) . 

(vi)  For  Ffi  (Ol/TA’),  it  implies  D<-S  followed  by  D*-f!  (S’, Si . D*) . 

A  1  l 

This  requires  VS  4  V  (VS* ,YS' , . . . ,VS) .  Here  VS  can  be  considered  as  a 
destination  operand  VD'.  So  ve  rewrite  the  inequality  as  TO'  4  f’,(QTA3). 

A 

(vii)  For  F9  (cn/TlA'),  VS£f'  »  VS,  (QTA4) .  Q.F..D. 

Theorem  3.  Control  faults  A/4> ,  A/T'  and  A/A+T'  can  be  detected  if  the  data 
valued  of  registers  satisfy  the  following  inequalities. 


QAT1. 

f .  4  VD 

A 

OAT  2. 

f  4  vs' 

A 

QAT3. 

v.  4  v. 

i  j 

»  i  ^  j 

QAT4. 

f,  4  TO' 

QAT5. 

fA  (vs') 

4 

fA(VD) 

QAT  6 . 

f,  L  VS’ 
A 

A 

r 

fA 

where  f A  -  fA  (VS^  ,VS?, . . . ) ,  f^VD)  =  ^(VS^VS^  . . . , TO)  .  fA(VS')  - 
fA  (VS1» 

Piocf .  Since  arithnatical  and  logical  operations  instead  of  transfer 
operations  are  considered  here,  we  can  change  VS  to  in  the  cases  (i),  (ii), 
(iv),  (vi)  and  (vii)  of  Theorem  1. 

(i)  For  FI  and  F2,  f  4  TO,  (CJAT1) . 

(ii)  For  F3,  f,  4  VS',  (QAT2) . 

(iii)  For  F4  and  F5,  VS'  4  TO',  (QAT3) . 

* 

(iv)  For  F6,  F^  4  TO',  (QAT4) . 

(v)  F7  (cA/T'A)  means  that  D«-S'  followed  by  D+f .  (S, ,S-, . . . ,D*)  which  yields 

A  i.  A 

f.(YS,,  VS„,..., VS').  When  there  is  no  fault,  fA(VS. ,  VS . VD)  is  obtained. 

A  1  2  A  1  l 


Thus  the  condition  for  detecting  this  fault  i6  f,(VS,,  VS-,..., VS*) 

A  1 _ 2 _ 

4  fA(VS1,VS2 . VD),  (QTA5) . 

(vi)  For  F8,  f.  VD,  (QTA1) . 

A _ 

(vii)  For  F9,  f  L  VS’  4  (QTA6) .  Q.E 

Theorem  l\,  Control  faults  A/A'  and  A/A+A'  can  be  detected  if  the  data  values  of 
registers  satisfy  the  following  inequalities. 


QAA1. 

V™ 

QAA2. 

fA  *  *A 

QAA3. 

f *  t  VD’ 

A 

QAA4. 

QAA5. 

fA  *  fA 

QAA6. 

fA  <fA>  *  fA 

QAA7. 

fA  £  lk  *  fA 

where  ^  *  f^(VSj,  VSJ,, . . .  ,f  A) ,  f A  (f^>  “  fA(VSl’VS2 . f'A>* 

Proof.  For  the  same  reason,  ve  may  change  VS  to  f.,  and  VS'  to  fj  for 

A  A 

cases  (i)  to  (iii)  and  (vii)  in  Theorem  1  to  obtain  QAA1  to  PAA3  and  QAA7 

respectively.  In  addition,  since  the  results  of  A  and  A’  may  affect  each  other, 

we  can  obtain  QAA4  to  QAA6.  Q.E. 

Note  that  for  requirement  QAA7,  if  operation  f,  and  f'  of  class  A  are 

A  A 

executed  in  the  sane  unit  (e.g.  ALU),  then  both  results  of  f .  and  f'  can  no 

A  A 

longer  be  considered  as  obtained  separately.  Instead,  PAA7  nay  be  considered 
as  a  data  manipulation  fault  (f  )/(f  )’. 
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IV.  WRITE  AND  READ  SEQUENCES 


As  a  nicroprocessor  is  one  type  of  sequential  machine  and  all  internal 
registers  are  memory  elements  of  the  sequential  machine,  the  content  of  registers 
represents  the  state  of  the  sequential  machine.  Therefore,  the  following 
procedure  is  utilized  for  testing  microprocessors. 

1.  Initialization  of  state  of  registers. 

2.  Execution  of  the  instruction-under-test. 

3.  Read  the  state  of  registers. 

In  fact,  Steps  1  and  3  consist  of  write  and  read  register  sequences  respectively. 
Obviously,  if  we  can  guarantee  the  correctness  of  Steps  1  and  3  first,  then 
the  testing  problem  will  be  simplified. 

The  testing  approach  used  here  is  a  kind  of  open  loop  testing  [6].  It 
implies  the  use  of  a  test  equipment  which  provides  the  stimuli  to  the  micro¬ 
processor  and  observes  the  responses  from  the  microprocessor. 

Now  let  us  discuss  write  and  read  sequences  which  are  used  for  writing 
and  reading  the  register  states  of  a  microprocessor.  They  consist  of  several 
basic  instructions,  called  the  kernel  of  nicroprocessor.  These  instructions 
of  the  kernel  can  be  carried  out  by  a  sequential  machine,  therefore,  we  can 
use  a  checking  experiment  to  verify  the  kernel. 


The  kernel  of  microprocessor 


Definition  1.  Kernel  instruction  set  -  A  small  subset  of  instructions  of  a 
microprocessor  which  can  be  used  for  constituting  the  write  and  read  register 


sequences. 

Definition  2.  Register  set  -  All  internal  registers  of  a  microprocessor  from  the 
view  of  the  architecture  or  programming. 

Definition  3.  Kernel  state  -  The  register  state,  i.e.  certain  set  of  data  values 
of  the  registers. 
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Definition  4.  Kernel  input  -  The  write  sequence  for  writing  a  set  of  data  into 
the  registers,  or  the  read  sequence  for  reading  out  the  contents  of  the  registers. 
Definition  5.  Kernel  output  -  The  set  of  data  values  of  the  registers  which  are 
read  out  by  the  read  sequence. 

B.  Kernel  instruction  set 

There  exists  many  choices  for  the  kernel  instruction  set.  In  order  to 
keep  the  kernel  small,  the  following  requirements  should  be  satisfied. 

1.  The  number  of  instructions  in  the  kernel  instruction  set  should  be 

small. 

2.  Functions  of  each  kernel  instruction  should  be  as  simple  as  possible. 

For  instance,  a  kernel  instruction  contains  mainly  transfer  type  of  operations, 
or  small  number  of  RTL  operations. 

3.  In  order  to  simplify  addressing,  the  priority  order  of  choosing  the 
addressing  mode  of  an  instruction  is  as  follows. 

.  For  write  register  instructions:  Immediate,  Direct,  Indirect. 

.  For  read  register  instructions:  Direct,  Indirect. 

For  the  existing  off-the-shelf  microprocessors,  Eost  registers  can  be 
written  into  or  read  from  directly.  These  registers  are  called  direct  access 
registers.  Others  are  indirect  access  registers  which  can  be  accessed  through 
the  direct  access  registers  in  certain  order  by  using  transfer  instruction 
among  registers. 

C.  Kernel  state 

In  order  to  simplify  the  testing,  during  the  checking  experiment,  ve  only 
use  a  few  states  for  the  good  kernel,  i.e.  we  define  several  sets  of  data  value 
for  the  registers.  Therefore,  ve  should  choose  the  data  values  (test  data) 
such  that  they  can  cover  as  cany  faults  as  possible. 
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V.  VERIFYING  WRITE  AND  READ  SEQUENCES 

We  use  the  checking  experiment  to  verify  the  kernel  of  a  microprocessor. 

The  main  task  is  to  decide  how  many  states  of  the  kernel  and  what  test  data  we 
use. 

Abrahar  and  Parker  [6]  use  the  k-out-of-n  codes  for  their  "register  read 
test"  procedure,  where  m  is  the  width  of  a  code  word  (i.e.  the  length  of  register), 
and  k  is  the  number  of  l's  in  the  code  word.  As  we  will  see,  this  type  of  code 
is  powerful  since  it  can  be  used  as  test  data  to  cover  most  control  faults  by 
using  fever  data.  We  will  use  the  k-out-of-n  codes  for  verifying  the  write 
and  read  sequences  as  well  as  for  testing  control  faults.  The  k-out-of-m  codes 
can  also  detect  stuck-at  type  faults,  but  do  not  guarantee  to  cover  all  data 
processing  faults. 

To  simplify  the  testing,  we  shall  only  use  transfer  operations  of  the  kernel 
instructions  in  write  and  read  sequences.  Therefore,  we  only  need  to  consider 
the  requirements  of  Theorems  1  and  2* 

A.  QTT1,  QTA1  and  QTT2 

The  k-out-of-m  codes  used  as  test  data  can  satisfy  requirements  QTT1, 

QTA1  and  QTT2  (V^  4  Vj  and  L  V^  4  V^) .  This  is  because  in  k-out-of-m 
codes,  all  code  words  are  distinct  and  the  AND (OR)  operation  of  any  two  code 
words  will  reduce  (increase)  the  number  of  l's  in  the  code  word,  thereby 
different  from  both  original  code  words. 

B.  QTA2 

During  the  checking  experiment  for  the  kernel,  there  exists  an  input  leaving 
the  kernel  state  unchanged.  Therefore,  transfer  operation  (in  write  sequence) 

IKS  implies  YD  =  VS,  then  the  requirement  QTA2,  f'  4  VS,  becomes  f'  4  VD.  This 

*»  A 

is  for  detecting  fault  OT/A*,  here  D  and  D'  are  the  same  register.  Therefore, 
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QTA2  is  changed  to  4  VD’  vhich  belongs  to  QTA3. 

C.  QTA3 

The  requirement  QTA3,  f^(VS ' ,VS ' , . . . )  4  VD’,  is  for  detecting  an  extra 
operation,  We  list  the  restrictions  of  operands  (test  data)  for  detecting 
operation  of  class  A  in  Table  2. 


Extra  Operations 

Restrictions  of  Operands 

BIT  SET 

© 

BIT  RESET 

© 

BIT  COMPLEMENT 

No 

INCREMENT 

No 

DECREMENT 

No 

DECIMAL  ADJUST 

© 

SHIFT 

4  0  (all  Os),  1  (all  Is) 

ROTATE 

*  0 ,  1_ 

COMPLEMENT 

No 

NEGATE 

No 

CLEAR 

4  0 

ADDITION 

4  0 

ADDITION  WITH  CARRY 

4  o,  -i 

SUBTRACTION 

4  o 

SUBTRACTION  WITH  BORROW 

4  o,  -l 

AND 

k-out~of-m  codes 

OR 

k-out-of-m  codes 

XOR 

k-out-of-ia  codes 

EXTENT)  SIGN 

4  0,  1 

ADDITION,  D^  +  S2 

the  least  significant  bit  LSE  =1 

ADDITION,  D<-D  +  S!  +  s2 

4  0;  VS’  +  VS^  4  0 

/EDITION,  Ek-S1  +  s2  +  s3 

© 

MULTIPLY 

4  o,i 

DIVIDE 

4  o,  l 

BIT  TEST 

© 

COMPARE 

© 

Modifying  flags 

© 

Table  2.  Restrictions  of  operands  for  detecting  faulty 
aritlj;.etic  or  logical  operations 
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(D  «  v£  use  two  tests  In  which  the  source  operands  are  complements  of 
each  other,  then  one  of  the  tests  can  detect  the  faulty  operation. 

(2)  These  operations  only  set  or  reset  the  flags.  V’e  use  two  tests  with 
the  identical  source  operands  and  two  sets  of  flags  which  are  complements  to  each 
other.  The  faulty  will  change  one  of  the  flags. 

(3)  The  execution  of  DECIMAL  ADJUST  (to  add  certain  values)  depends  on  the 
value  of  source  operand  and  the  flags.  We  can  use  either  method  in  case  1 

or  either  method  in  case  2  to  detect  the  operation. 

©  Operation  D*-S^  +  S£  +  S3  is  only  used  for  memory  address  addition. 

Rere  D  means  external  address  bus.  In  this  case,  the  unexpected  operation 
does  not  affect  the  write  and  read  registers.  Hence  it  needs  not  to  be 
considered  for  verifying  the  kernel. 

(D  During  the  checking  experiment  for  the  kernel,  if  ve  have  considered 
the  main  operations  in  arithmetic  and  logical  instructions  as  the  unexpected 
operation,  then  ve  need  not  consider  modifying  flogs  which  are  auxiliary 
operations. 

For  other  operations,  the  restrictions  are  obvious.  For  example, 

ADDITION  WITH  CARRY,  D'^D'  +  S'  +  CARRY  ,  if  CARRY  =  0  with  the  restriction 
VS'  ^  0  or  CARRY'  =  1  with  the  restriction  is  VS'  ^  -1,  then  VD'*  j*  VD'. 

Since  we  use  k-out-of-m  codes  as  operands,  these  restrictions  can  be  satisfied. 
For  operation  D'-*-D'  +  S|  +  Sj  ,  since  the  negative  value  of  any  k-out-of-m 
code  word  will  not  be  any  k-out-of-m  code,  i.e.  VS^  +  VS^  4  0;  so  VD'  +  VS^  +  VS^ 
f  VD'.  For  operation  D'^S^  +  S^,  ve  can  divide  the  k-out-of-m  codes  into  two 
groups  with  different  LSB  (Least  Significant  Bit).  These  two  groups  complement 
each  other.  The  group  with  the  restriction  LSB  =  1  will  be  used  for  testing. 


For  operation  ROTATE,  the  restriction  is  for  the  case  of  the  odd  number  of 
shifted  bits.  Otherwise,  we  need  other  restriction  (e.g.  using  subset  of 
k-out-of-m  codes  as  operands). 

D.  QTA4 

The  checking  experiment  does  not  guarantee  requirement  QTA4,  VS  £  F!  i  VS. 

A 

For  example,  for  the  normal  transfer  operation  T,  D+-S,  with  VS  =  0101,  VD  =  0110 

(using  2-out-of-4  codes),  if  there  exists  a  fault  ot/TAA'  and  the  extra 

operation  A'  is  INCREMENT,  EH-IH-1 ,  then  f*  =  VD  +  1  =  0111.  If  L  is  an  AND  function, 

then  VS  I  f J  ■  VS.  Thus  QTA4  cannot  be  satisfied.  Therefore,  ve  need  another 

test  procedure  to  remedy  this.  The  remedy  is  to  change  the  value  of  S  to  1 

or  ()  depending  upon  L  being  AND  or  OR  respectively.  From  the  above  example, 

we  see  that  if  L  is  an  AND  function,  let  VS  «  1  then  QTA4  becomes  f!  ^  1  which 

—  A  — 

can  be  satisfied.  Similarly,  if  L  is  an  OR  function,  let  VS  =  ()  and  QTA4  changes 
to  f'  y  0. 

A  — 

Now  let  us  check  this  remedy  method  for  all  operations  of  class  A.  Note 
that  we  only  change  the  value  of  S  in  operation  D<-S,  and  D’  in  operation  A'  can 
be  substituted  by  D. 

(i)  For  class  Al,  D«-f^(D).  If  v:e  use  k-out-of-m  codes,  the  new 
requirement  QTA4',  fj^  j1  1  (£) ,  depending  on  L,  can  be  satisfied  except  the 
operation  CLEAR  with  L  being  OR.  But  in  this  case,  the  result  of  f'  is  always 

A 

()  which  does  not  affect  the  operation  D*-S. 

(ii)  Fcr  class  D*-f^(D,S').  No  matter  S'  is  the  same  register  as  S 

or  not,  Q7AA *  is  true  except  the  following  case:  when  S’  and  S  are  the  same 

register,  then  for  QTA4 ' ,  f'  ^  1  (f'  is  operation  OR  and  L  is  AND)  and  f!  M 

A  A  A 

(f^  is  operation  AND  and  L  is  OR)  cannot  be  met.  But  in  this  case,  if  S’  and 
S  are  the  same,  VSZ-f ’  is  always  the  same  as  VS,  the  fault  does  not  affect  FH-S, 
i.e.  VSA(VD'.VS)  =  VS  and  VSV(VDAVS)  =  VS  for  any  operands  D  and  S. 


(iii)  For  the  EXTEND  SIGN  operation,  D*-f^(S'),  the  result  of  is  0^  or  1. 
Similarly  with  case  (i),  either  QTA4  can  be  met  or  the  fault  does  not  affect 
operation  T. 

(iv)  For  classes  A3  and  AF,  QTA4  can  be  satisfied.  For  the  same 
reason  as  QTA3,  we  need  to  consider  neither  modifying  flags  operation  nor 
IH-Sj  +  S2  +  S^. 

(v)  For  MULTIPLY  and  DIVIDE,  since  the  execution  period  of  these  operations 
generally  is  longer  than  that  of  transfer  operations,  fault  af/fZ»fT  cannot  exist 
and  we  do  not  consider  QTA4. 

In  summary,  during  the  checking  experiment  we  only  need  three  sets  of 

test  data  for  internal  registers.  Let  n  be  the  number  of  the  internal  register, 

m  be  the  length  of  registers.  Suppose  that  m  is  even.  Let  V  denote  a  complete 

% 

set  of  k-out-of-m  code  words.  Usually,  k  =  [v|  =  ^m/2^  be  the  maximum 

number  of  distinct  codes.  We  divide  them  into  two  groups,  and  V  with  different 

LSB.  These  two  groups  are  complementary  to  each  other.  Note  that  for  most 

microprocessors,  m  is  even,  and  |v|  >  2n. 

Let  {a}  =  {a., a.,..., a  },  {a}  *  a,,a_,...,a  },  {u}  and  {a}  belongs  to 

12  n  12  n 

V  ana  V.  respectively.  We  now  construct  four  sets  of  data  as  follows. 

— 0  —1 


Flag  register 

Other  registers 

Q1 

■mum 

“l 

Q1 

Q-»  g,  ...  ,  a 
ix  n 

Q1 

•••  )  ® 

/  J  n 

In  order  to  satisfy  requirement  QTA3,  we  can  choose  ar.y  three  sets  of  data  as 
the  initial  values  of  registers  (test  data).  In  fact,  one  needs  a  few  more 
data  as  external  bus  inputs  during  testing.  Therefore,  the  final  number  of  code 


Now  we  will  derive  the  checking  sequence  for  the  kernel.  As  we  mentioned 


before,  we  only  use  three  sets  of  test  data  for  the  kernel,  namely  a,  b  and  c. 


where  W  ,  V  ,  V  -  write  sequences  for  writing  a,  b  and  c  respectively. 

A  D  C 

R  -  read  sequence. 

A,  B,  C,  A*,  B*,  C*  -  Kernel  states.  A,  E  and  C  are  the  states  after 
applying  the  corresponding  write  sequences  W^,  K^.  A*,  B*  and  C*  are  the 

states  after  applying  read  sequence  R. 

a,  b,  c,  a*,  b*,  c*  -  Kernel  output  sequences  produced  by  read  sequence  R 
for  states  A,  B,  C,  A*,  B*,  C*  respectively. 

©  denote  the  state  transition  i. 

Since  we  only  use  three  sets  of  test  data,  the  number  of  states  of  the  kernel  is 
constant.  It  means  that  the  above  flow  tables  are  independent  of  microprocessors 
Therefore,  we  can  easily  obtain  the  checking  sequences  with  the  same  form. 

There  are  three  requirements  to  derive  a  checking  sequence  [12,13]. 

1.  Initialization  of  the  machine  (kernel)  state  using  sychronizing 
sequence  or  homing  sequence. 

2.  Identify  all  machine  states  using  distinguishing  sequence. 

3.  Verify  each  transition  using  distinguishing  sequence. 

For  our  kernel,  there  exists  sychronizing  sequences  W  or  V.  or  V  and 

a  b  c 

distinguishing  sequence  R.  Therefore,  we  can  easily  derive  checking  sequences 
as  follows. 


Checking  Sequence  1  (for  case  1) 
Initialization 


W 


Identify  all  states 

^  *  X 

R  R  W,  R  R  W  R 


© 


w  cw 


(D  <0 


© 


w 


V 


w 


w. 


vv 


0  0 


©  0 

\  \  ♦  t 

Verify  all  state  transitions  (i.e.  next  states). 


vv 

® 


W 

© 


Vv 

© 


vb  R 


Checking  sequence  2  (for  case  2) 


Initialization 


/  Identify  all  states 

f  M  \  \ 

WRRRW.  RRRWR  RRWRWRWR  W.  R  W.  R  W  R  W  R 

a  b  c  accbbaa 

^  ^  ^  y  y  v  *V  V'  'V  ^  s*'  v*/ 

©  ©  ©  ©*.©  o  @  ©  ©  ©  ©  ©  ©  (D  © 

♦  i  ♦  T  i  **• 

Verify  all  state  transitions  (i.e.  next  states) 


W  W  R  V  V,  R  \l  V.  R  W,  W  R  W  W  R  W  W  R  W  W  R  W  R  Wv  V  R 
aa  ab  bb  be  cc  ca  ac  cb  ba 


Finally,  ve  can  obtain  tvo  test  procedures  for  verifying  the  write  and  read 


sequences  as  follows. 


Procedure  1:  Checking  experiment 


1.  If  a  microprocessor  does  not  have  indirect  access  registers,  we  use 
checking  sequence  1. 

2.  If  a  microprocessor  has  indirect  access  registers,  we  use  checking 
sequence  2. 

Procedure  2:  Remedy  testing 

For  each  of  the  three  sets  of  register  values  a,  b  and  c,  do  the  following 
for  each  register. 

1.  Initialization  of  all  registers. 

2.  Write  1  or  0  into  the  given  register  depending  on  the  circuit 
implementation. 

3.  Read  the  given  register. 

Therefore,  from  the  previous  discussion  in  this  section,  we  obtain  the  following 
theorem. 

Theorem  5.  Procedures  1  and  2  can  verify  write  and  rind  sequences,  ar.d  after 
that  the  registers  of  a  microprocessor  can  be  initialired  to  any  values. 


VI.  TESTING  CONTROL  FAULTS 


During  the  verification  of  the  correctness  of  write  and  read  sequences, 
we  are  only  concerned  with  certain  transfer  operations  (not  all  RTL  operations) 
in  the  kernel  instructions.  Therefore,  when  we  test  instruction  decoding  and 
other  control  faults,  we  need  to  test  all  instructions  included  in  the  kernel. 
Procedure  3.  Testing  instruction  decoding  and  other  control  faults 

For  each  instruction,  do  the  following  steps, 

1.  Initialize  register  state  using  any  particular  initial  values 
(test  data). 

2.  Execute  the  instruction  instruction-under  test. 

3.  Read  register  state. 

Note  that  we  should  first  try  to  use  three  sets  of  data  values  a,  b  and  c 
at  Step  1. 

Generally  we  need  several  tests  for  each  instruction  to  detect  the 
instruction  decoding  and  other  control  faults.  Obviously,  the  lower  bound 
of  the  number  of  tests  using  Procedure  3  for  each  instruction  is  two.  This 
is  because  any  kind  of  microprocessors  has  several  pairs  of  conditional  branch 
instructions  based  on  two  different  values  for  the  same  condition  source. 
Therefore,  when  any  instruction  is  under  test,  in  order  to  detect  an  unexpected 
branch  instruction  due  to  a  fault,  we  need  at  least  two  test  patterns. 

The  upper  bound  on  the  test  for  each  instruction  is  dependent  upon  the 
microprocessor— under— test .  We  can  roughly  estimate  the  order  of  tests  for 
detecting  instruction  decoding  faults.  We  consider  r<^  instructions  to  be 
tested,  assume  that  each  instruction  corresponds  to  an  operation,  class  T  or 
class  A,  used  for  distinguishing  instructions  from  each  other.  Let  n^  and 
n  denote  the  number  of  instructions  which  have  operations  class  T  and 


class  A  respectively,  i.e.  tm.  ■  n__  +  n_.. 

i  IT  LA 

A.  Testing  instruction  class  T 

1.  The  case  of  Theorem  1 

Since  for  some  condition  branch  instructions,  their  operations  belong  to 
class  T,  and  they  are  condition  transfer  operations.  In  order  to  detect  this 
unexpected  operation  T*,  tvo  tests,  in  which  test  data  are  complement  to  each 
other,  are  sufficient. 

2.  The  case  of  Theorem  2 

First  of  all,  we  use  three  sets  of  initial  values  a,  b  and  c  for  covering 
the  requirements  QTA1  and  QTA3.  In  order  to  satisfy  QTA2  and  QTA4,  we  can 
modify  a,  b  and  c  separately  as  new  test  data.  As  we  have  discussed  in 
Section  V,  if  the  instruction-under-test  has  a  transfer  operation  Eh-S,  we  can 
change  VS  in  original  data  a,  b  and  c  to  VD,  then  QTA2  becomes  QTA3  which  can 
be  satisfied.  Similarly,  we  can  change  VS  to  1_  (or  0)  to  satisfy  QTA4.  Here 
we  need  nine  tests  altogether.  Thus,  the  order  of  the  number  of  tests  for 
testing  Instruction  class  T  is  O(n^). 

B.  Testing  instruction  class  A 

1.  The  case  of  Theorem  3 

Test  data  a,  b  and  c  can  cover  QAT1  and  QAT3.  Similarly,  in  order  to 
satisfy  QAT2,  QAT4,  QAT5  and  QAT6,  we  can  modify  a,  b  and  c  in  turn.  First, 
we  change  VS'  and  VD*  to  VD  for  covering  QAT2  and  QAT4  respectively.  These 
changes  are  done  for  each  register,  so  it  needs  3n  tests,  where  n  is  the  number 
of  registers.  Then  we  change  VS'  to  a  particular  value  for  covering  QAT5  and 
QAT6  separately.  It  needs  6n  tests.  So  the  total  number  of  tests  for  each 
instruction  in  this  class  will  be  9n+3. 

2.  The  case  of  Theorem  4 


We  need  three  tests  using  a,  b  and  c  for  covering  QAA1  and  QAA2. 


Then  we  attenpt  to  find  five  particular  tests  to  satisfy  QAA3  through  QAA7  for 

each  unexpected  operation  A'.  So  the  number  of  tests  for  each  instruction  in 

this  class  will  be  3  +  5  (n_.  -1)  *  5  nTA  -2. 
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Therefore,  the  order  of  the  number  of  tests  for  testing  instruction  class  A 


VII.  CONCLUSION 


In  this  paper,  we  presented  three  test  procedures  to  verify  the  write 
and  read  sequences  and  to  test  control  faults  at  the  RTL  level. 

A  control  fault  oodel  is  defined  at  the  RTL  level  instead  of  the 
instruction  level.  This  allows  us  to  model  the  fault  more  accurately. 

Based  on  the  control  fault  model,  we  consider  the  write  and  read 
register  sequence  functions  as  the  kernel  of  a  microprocessor  independent  of 
microprocessors.  The  similarity  between  the  kernel  of  a  microprocessor  and  a 
sequential  machine  allows  us  to  obtain  the  checking  sequences  to  verify  the 
kernel.  Therefore,  testing  of  microprocessors  can  be  simplified. 

We  mainly  use  k-out-of-m  codes  as  test  data  which  can  cover  more  control 
faults.  Therefore,  the  number  of  test  patterns  can  be  reduced. 

Further  work  includes  the  enumeration  of  the  control  faults  at  the  RTL 
level  for  the  generation  of  tests  for  covering  all  possible  control  faults 
in  a  microprocessor. 
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VI.  TESTING  CONTROL  FAULTS 
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During  the  verification  of  the  correctness  of  write  and  read  sequences, 
we  are  only  concerned  with  certain  transfer  operations  (not  all  RTL  operations) 
in  the  kernel  instructions.  Therefore,  when  we  test  instruction  decoding  and 
other  control  faults,  we  need  to  test  all  instructions  included  in  the  kernel. 
Procedure  3.  Testing  instruction  decoding  and  other  control  faults 

For  each  instruction,  do  the  following  steps, 

1.  Initialize  register  state  using  any  particular  initial  values 
(test  data). 

2.  Execute  the  instruction  instruction-under  test. 

3.  Read  register  state. 

Note  that  we  should  first  try  to  use  three  sets  of  data  values  a,  b  and  c 
at  Step  1. 

Generally  we  need  several  tests  for  each  instruction  to  detect  the 
instruction  decoding  and  other  control. faults.  Obviously,  the  lower  bound 
of  the  number  of  tests  using  Procedure  3  for  each  instruction  is  two.  This 
is  because  any  kind  of  microprocessors  has  several  pairs  of  conditional  branch 
Instructions  based  on  two  different  values  for  the  same  condition  source. 
Therefore,  when  any  instruction  is  under  test,  in  order  to  detect  an  unexpected 
branch  instruction  due  to  a  fault,  we  need  at  least  two  test  patterns. 

The  upper  bound  on  the  test  for  each  instruction  is  dependent  upon  the 
microprocessor-under— test.  We  can  roughly  estimate  the  order  of  tests  for 
detecting  Instruction  decoding  faults.  We  consider  n^.  instructions  to  be 
tested,  assume  that  each  instruction  corresponds  to  an  operation,  class  T  or 
class  A,  used  for  distinguishing  instructions  from  each  other.  Let  nIT  and 
n  denote  the  number  of  instructions  which  have  operations  class  T  and 


class  A  respectively,  i.e.  n^  ■ 
A.  Testing  Instruction  class  T 


1.  The  case  of  Theorem  1 

Since  for  some  condition  branch  instructions,  their  operations  belong  to 
class  T,  and  they  are  condition  transfer  operations.  In  order  to  detect  this 
unexpected  operation  T’,  tvo  tests,  in  which  test  data  are  complement  to  each 
other,  are  sufficient. 

2.  The  case  of  Theorem  2 

First  of  all,  we  use  three  sets  of  Initial  values  a,  b  and  c  for  covering 
the  requirements  QTA1  and  QTA3.  In  order  to  satisfy  QTA2  and  QTA4,  we  can 
modify  a,  b  and  c  separately  as  new  test  data.  As  we  have  discussed  in 
Section  V,  if  the  instruction-under-test  has  a  transfer  operation  IKS,  we  can 
change  VS  in  original  data  a,  b  and  c  to  VD,  then  QTA2  becomes  QTA3  which  can 
be  satisfied.  Similarly,  we  can  change  VS  to  1^  (or  0)  to  satisfy  QTA4.  Here 
we  need  nine  tests  altogether.  Thus,  the  order  of  the  number  of  tests  for 
testing  instruction  class  T  is  OCn^). 

B.  Testing  instruction  class  A 

1.  The  case  of  Theorem  3 

Test  data  a,  b  and  c  can  cover  QAT1  and  QAT3.  Similarly,  in  order  to 
satisfy  QAT2,  QAT4,  QAT5  and  QAT6,  we  can  modify  a,  b  and  c  in  turn.  First, 
we  change  VS'  and  VD’  to  VD  for  covering  QAT2  and  QAT4  respectively.  These 
changes  are  done  for  each  register,  so  it  needs  3n  tests,  where  n  is  the  number 
of  registers.  Then  we  change  VS’  to  a  particular  value  for  covering  QAT5  and 
QAT6  separately.  It  needs  6n  tests.  So  the  total  number  of  tests  for  each 
Instruction  in  this  class  will  be  9n+3. 

2.  The  case  of  Theorem  4 

We  need  three  tests  using  a,  b  and  c  for  covering  QAA1  and  QAA2. 
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Then  we  attempt  to  find  five  particular  tests  to  satisfy  QAA3  through  QAA7  for 
each  unexpected  operation  A* .  So  the  number  of  tests  for  each  instruction  in 


this  class  will  be  3  +  5  (nT4  -1)  K  5  nT.  -2. 

1A  IA 

Therefore,  the  order  of  the  number  of  tests  for  testing  instruction  class  A 
2 

is  0  (n*nTA  +  i^.). 


VTI.  CONCLUSION 


In  this  paper,  we  presented  three  test  procedures  to  verify  the  write 
and  read  sequences  and  to  test  control  faults  at  the  RTL  level, 

A  control  fault  oodel  is  defined  at  the  RTL  level  instead  of  the 
instruction  level.  This  allows  us  to  model  the  fault  more  accurately. 

Based  on  the  control  fault  model,  we  consider  the  write  and  read 
register  sequence  functions  as  the  kernel  of  a  microprocessor  independent  of 
microprocessors.  The  similarity  between  the  kernel  of  a  microprocessor  and  a 
sequential  machine  allows  us  to  obtain  the  checking  sequences  to  verify  the 
kernel.  Therefore,  testing  of  microprocessors  can  be  simplified. 

We  mainly  use  k-out-of-m  codes  as  test  data  which  can  cover  more  control 
faults.  Therefore,  the  number  of  test  patterns  can  be  reduced. 

Further  work  includes  the  enumeration  of  the  control  faults  at  the  RTL 
level  for  the  generation  of  tests  for  covering  all  possible  control  faults 
in  a  microprocessor. 
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